Google Chrome CVE-2026-106287

Exploitation requires the victim to visit or interact with attacker-controlled web content (UI:R) running in an unpatched Google Chrome build prior to 155.0.8059.39; the attacker then sends crafted cross-origin network traffic that abuses the CORS implementation to bypass web-origin-policy enforcement. No authentication or elevated privileges are needed (PR:N), and attack complexity is low (AC:L), but the mandatory user-interaction step and the Chromium-assessed 'Low' severity with integrity-only impact meaningfully limit real-world risk. The primary limiting factor is Chrome's silent auto-update mechanism, which rapidly reduces the exposed population.

This is a genuinely low-priority issue where every available signal agrees. The CVSS base score is 4.3 (Medium-low), and the vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) shows only a limited integrity impact with no confidentiality or availability loss, scope unchanged, and mandatory user interaction (UI:R). Google itself rated the Chromium security severity as 'Low.' EPSS reinforces this: 0.17% probability at only the 6th percentile, indicating very low likelihood of exploitation in the wild. There is no CISA KEV listing and no POC referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision record was supplied. The one mild tension worth noting: the CWE is CWE-221 (Information Loss/Omission) and the description frames this as 'Information loss in CORS' that lets an attacker 'bypass web origin policy,' which intuitively suggests a confidentiality-adjacent cross-origin data concern, yet the official vector sets C:N and attributes the single impact to I:L - verify the exact impacted asset with Google if confidentiality of cross-origin responses is a concern. Net assessment: real but low-severity, not an urgent remediation priority beyond normal Chrome auto-update hygiene.

An attacker lures a victim to a malicious web page (satisfying the UI:R user-interaction requirement), which issues crafted cross-origin network traffic that abuses the CORS implementation to weaken enforcement of the web origin policy. Because scope is unchanged and impact is limited to integrity (I:L), the realistic result is partial circumvention of cross-origin restrictions rather than full data theft or code execution. No public exploit code is identified at time of analysis.